P1
Legal Operating Model
LegacyAutonomous
- Legacy
- Matters, contracts, and reviews run manually with no AI in the workflow.
- Autonomous
- AI-native workflows compound, self-improving from every matter and contract closed.
AIR FOR LEGAL & COMPLIANCE
Where AI Readiness Becomes a Question of Privilege, Defensibility, and Duty
A function-specific read on how AI is embedded, governed, and standardized across the legal and compliance team, scored from Legacy to Autonomous.
Regulators, courts, and clients now expect documented AI governance, and the legal team that polices everyone else cannot afford to run its own AI on hope.
What AIR measures
Five pillars, read for Legal & Compliance.
The same five pillars of AI readiness, framed in the work, systems, and stakes that general counsel and compliance leaders actually face.
P1Legal Operating Model
Whether AI is built into how legal work actually gets done, from intake and contract review to research and matter management, as durable shared assets rather than one associate's private prompts.
P2Work Product & Defensibility
How AI changes what the function produces and whether that output is reviewed, validated, and defensible enough to file, advise on, or put in front of a regulator.
P3Talent & Capability
How broadly real AI fluency runs across lawyers, paralegals, and compliance staff, and whether reskilling and redefined roles are owned rather than left to a few power users.
P4Governance & Risk
The function's own AI policy, privilege and confidentiality controls, QC of AI output, and the regulation that touches it, applied to itself with the rigor it demands of the business.
P5Tool Standardization
Whether the legal AI stack and its spend are a deliberate, owned, contract-reviewed system or a sprawl of point tools nobody vetted for privilege, retention, or IP terms.
The AIR rating
Six tiers, Legacy to Autonomous.
AIR places Legal & Compliance on a six-tier readiness ladder from 0 to 100, overall and for every pillar. The climb runs from digital but not intelligent, to a compounding, AI-native edge.
6
Autonomous
85–100AI-native advantage. Compounding intelligence and speed, a durable edge competitors can't copy fast.
5
Integrated
68–84Woven through the business. AI shapes the operating model, pricing, and talent, and ROI is proven.
4
Operational
51–67AI in the core, governed. Embedded at named steps with SOPs, policy, and measured gains.
3
Adopting
34–50Pockets, not a system. Real use in places, uneven and undocumented.
2
Reactive
17–33Experimenting at the edges. Scattered pilots that live in a few people's heads, ungoverned.
1
Legacy
0–16Digital, not intelligent. AI is absent or anecdotal, work is hour-priced, the stack sprawls, and no policy exists.
The point
One score tells you that you are behind; five tiers tell you exactly where to start.
The deep diagnostic
Every pillar, climbed for Legal & Compliance.
The matrix is a 5-by-6 grid: your five pillars of AI readiness scored against the same six tiers, from Legacy to Autonomous. A single overall score tells you roughly where you sit; it hides where you are dangerously behind and where you are quietly ahead. Reading a tier per pillar turns one vague number into five specific, fixable verdicts, so you act on the truth instead of an average.
P2
Risk, Enablement & Defensibility Model
LegacyAutonomous
- Legacy
- Risk reviews, guidance, and approvals are slow, manual, and inconsistently recorded.
- Autonomous
- Compounding risk intelligence makes the function a durable, defensible competitive edge.
P3
Legal Talent & AI Fluency
LegacyAutonomous
- Legacy
- The team has no AI fluency and treats AI as off-limits or untrustworthy.
- Autonomous
- The team is AI-native, designing new legal capabilities and compounding its own expertise.
P4
AI Governance & Regulatory Risk
LegacyAutonomous
- Legacy
- No AI policy exists and privilege, confidentiality, and quality controls are absent.
- Autonomous
- Governance is continuous and self-monitoring, turning compliance into a durable advantage.
P5
Legal AI Tool Standardization
LegacyAutonomous
- Legacy
- No AI tools are sanctioned and the function relies on manual legacy systems.
- Autonomous
- A defensible, continuously optimized tool stack compounds value and adapts ahead of need.
Governance and compliance
Where the rules bite.
How Legal & Compliance's regulatory reality maps onto AIR readiness. Each row is a control your governance pillar has to carry.
| Regime | Pillar | What AI readiness requires |
|---|---|---|
| EU AI Act | P4 | classify AI used in legal and compliance workflows by risk and maintain the documentation, human oversight, and logging the tier requires |
| NIST AI RMF 1.0 | P4 | govern, map, measure, and manage AI risk across the function with named owners and recorded decisions, not informal habit |
| ISO/IEC 42001 | P1 | run a documented AI management system with defined roles, controls, and continual improvement embedded in how the function operates |
| Attorney-client privilege and work-product doctrine | P4 | ensure AI tools and prompts do not waive privilege or expose work product, with confidentiality controls and vendor terms reviewed |
| E-discovery duties (FRCP Rule 26 / Sedona Conference) | P2 | validate, defend, and document AI-assisted review and TAR so output withstands proportionality and reasonableness challenges |
| IP ownership and vendor contract terms | P5 | confirm tool contracts settle ownership of AI output, training-data use, and indemnity before the stack is standardized |
Illustrative mapping for AI-readiness planning, not legal or compliance advice; validate against current regulation and your jurisdiction with qualified counsel.
The stakes
What stalling looks like.
Privilege waiver through the tool
An attorney pastes privileged communications or work product into a consumer AI tool whose terms permit training or retention. The disclosure can waive privilege and surface in discovery, and no policy or technical control stops it today.
Hallucinated authority in a filing or memo
AI invents case citations, statutes, or contract clauses that read as authoritative and reach a brief, opinion, or regulator without verification. Sanctions, malpractice exposure, and lost credibility follow when no QC checkpoint catches confidently wrong output.
Undisclosed AI in regulated advice
AI-assisted analysis informs compliance determinations or client advice with no record of how it was used or checked. When a regulator or court asks how the conclusion was reached, the function cannot show a defensible, documented process.
Confidential and personal data leaking into ungoverned tools
Client confidential information, deal data, and personal data flow into AI tools outside enterprise environments with no retention controls or data-processing terms. This breaches confidentiality duties and data-protection law before anyone notices.
The policy-setter with no policy of its own
Legal and compliance write the firm's AI rules yet run their own AI use informally, with no written policy the team has read. The credibility gap undermines enforcement and surfaces in the first audit or incident.
Start now
Signature quick wins for Legal & Compliance.
Concrete first moves you can make before the full diagnostic, one per pillar where it matters most.
P4Days
Ship the legal AI use policy first
Write a one-page AI policy for the function that names approved tools, bans pasting privileged or client-confidential material into consumer tools, and have every lawyer and paralegal read it this week.
P2Days
Mandate a citation and output check
Require that every AI-assisted citation, clause, and factual assertion is verified against source before it enters a filing, memo, or compliance determination, and log that the check happened.
P5Weeks
Review tool terms for privilege and IP
Audit each AI tool the function touches for data retention, training-on-input, confidentiality, and output-ownership terms, and retire or renegotiate any that put privilege or IP at risk.
P1Weeks
Turn one workflow into a shared SOP
Take a high-volume task like NDA review or first-pass research and document the exact step where AI plugs in, converting one person's prompts into a shared, versioned SOP the team applies.
P3Days
Name an owner and run a fluency session
Appoint one person to own legal AI capability with protected time, and run a role-specific session for paralegals and junior lawyers on safe, effective AI use in their actual workflows.
P4A quarter
Stand up a privilege-safe enterprise environment
Move privileged and personal-data work into an enterprise AI environment with retention controls and a data-processing agreement, and block consumer tools for client matters.
Find out where your team stands.
The old transformation is finished. The new one is scored.